What shim keeps, and who can read it

A prompt, only when a rule in your policy matches it. The extension then records the exact original text, including monitor-only matches and prompts the employee later cancels, edits or masks. When the employee chooses Edit or mask, the version actually applied is captured too, under the same request ID.

A file, only as its findings: its name and each distinct matched value with where it was found, how often it appears and up to 40 characters around it from the same line. The rest of the file never leaves the browser.

Every request carries the matched rules and categories, the policy version in force, the employee’s choice and the device that reported it. When a rule opens a review, the dialog tells the employee about this capture before they choose. Monitor-only rules capture without a dialog, so tell employees about them in your own AI-use policy.

Documented in Requests and evidence and in Policies.

Prompts that match no rule. A clean submission may be reported as allowed, with its application, time and policy version, but never with its text, account or conversation.

Whole files. For a flagged file, administrators see each matched value in place, with the words around it on the same line and where it was found, never the rest of the file. Edits that fail the recheck are not recorded as applied versions. No text is captured from composers shim does not recognize, and text inside images and voice are outside the current release.

Documented in Requests and evidence and in Get started.

Which AI apps from shim’s list each managed browser has open on each day, such as Perplexity on 11 October, when the browser’s policy turns on AI app discovery. The extension matches the tab’s address against the list and keeps only the app and the day: never the address, the page or what was typed, and nothing from incognito windows. It runs nothing on those pages. With discovery off, the browser records nothing and the console ignores any days it receives.

The console’s AI apps page shows organization totals for the last 30 or 90 days: how many browsers opened each app, on which days, and whether shim protects it. Administrators also see which teams and browsers opened each app; viewers see the totals only. Each record is deleted 90 days after its day. Administrators can label an app Approved or Not approved for everyone in the console to see; a label never blocks or allows anything, and shim leaves blocking to your browser policy.

Documented in Requests and evidence and in Coverage and limits.

In the employee’s browser. When they send, the extension checks the draft in a recognized ChatGPT, Claude or Gemini composer against your current policy, and uploads nothing to decide. Attached files are checked the same way when they are attached, before the site can upload them. Reporting to the console happens separately, after the decision.

Policies sync from the console every minute, and a browser that loses contact keeps enforcing its cached policy for 24 hours. Once that policy expires, every prompt in a recognized composer is blocked by default until the next sync. A browser that is not enrolled cannot send from a recognized composer.

Documented in Get started and in Policies.

Administrators of your organization. Prompt versions are fetched one request at a time, when an administrator opens it in the request inspector, through an endpoint that checks both the administrator role and the organization. Request lists, filters and the overview carry metadata only, never prompt text, file findings or Send once explanations.

Viewers see that a request happened and how it ended, but cannot open prompts. The alpha console cannot create viewer accounts yet: every account that bootstrap creates is an administrator. Device credentials cannot stand in for a console session, so an enrolled browser cannot read prompts back.

Documented in Requests and evidence.

Each version is kept for 90 days from its own capture. The original prompt and an applied edit or mask each keep their own clock, and the inspector shows when each will be deleted. Expired text is excluded from reads immediately, and an hourly task clears it from the active database while the server runs. Text still waiting in a browser’s upload queue expires on the same schedule.

Request metadata, the employee’s choice, the Send once explanation, and account and conversation context currently have no deletion period. Copies in your database backups follow your backup retention, so set the two to match.

Documented in Requests and evidence.

For a matched request, the email of the ChatGPT, Claude or Gemini account the employee is signed in with, and the conversation ID once the prompt is allowed to send. Cancelled and blocked prompts have no conversation ID; clean prompts carry neither.

ChatGPT’s email comes from its page data, Gemini’s from the Google Account link label, and Claude’s from one same-origin account request that keeps only the email address. This context is shown only to administrators, and it does not expire with prompt content.

Documented in Requests and evidence.

Send once lets an employee send the original prompt one time past a warning rule. After choosing it, they can add an optional explanation of up to 500 characters. They write it themselves; shim never fills it from the prompt, and the field warns them: “Administrators can read this; avoid sensitive data.”

Only administrators can read it, beside that decision in the request inspector. It is stored with the decision record, so it does not expire with prompt content. Required masking and blocking rules never offer Send once.

Documented in Policies and in Requests and evidence.

You deploy it: one web server for the administrator console and its API, with PostgreSQL as the persistent store. The database URL and signing secret are supplied as environment variables when the server starts, not built into it. Outside local development, the console origin must use HTTPS.

PostgreSQL holds administrator accounts and sessions, every version of each policy, teams, enrolled devices, one-time enrollment codes, request activity (metadata, prompt versions until they expire, and account and conversation context), the AI apps each browser opened per day and your AI app labels. Sign-up is disabled; a one-time bootstrap command creates the first administrator.

Documented in Deploy the console.

It is a gate in the page, not a network filter. shim checks text when a recognized composer submits it, but cannot intercept the browser’s network traffic or stop a hostile page or script that sends text another way.

It checks text and attached files in recognized composers only. Text inside images, voice, desktop applications and direct API calls are outside the current release, and an unrecognized composer is reported as unsupported. ChatGPT can upload a draft in the background before Send. shim blocks the one such request it has seen; other routes have not been verified.

Allowed means the gate let the text go, not that delivery was confirmed. shim is in alpha: live-site coverage and managed installation are being validated.

Documented in Coverage and limits.

shim’s server code writes one fixed line when a request fails: no body, headers, prompt text, credentials or error detail. The API answers with an error code. Device credentials and enrollment codes are stored as SHA-256 hashes and passwords are hashed, so the database keeps none of them readable.

The extension’s heartbeat reports its version, policy version, composer coverage and, when its policy turns on AI app discovery, the AI apps it had open by day only. Its device credential never reaches ChatGPT, Claude or Gemini pages. Logs written by your hosting platform are yours to configure.

Documented in Deploy the console.

Email security@getshim.tech with the affected part (console, API or extension), its version, the steps to reproduce and what you observed. Use synthetic prompts and test accounts; never send real credentials, customer prompts or personal data.

Please give us the chance to fix the issue before you disclose it publicly.

This policy is also published at /.well-known/security.txt.